When the Data Subject Writes: A Firmwide Routine for Access Requests
Photo: Jaggery , CC BY-SA 2.0, via Wikimedia Commons
A subject access request seldom announces itself as a governance event. It may be a short email from a client, a former employee, a counterparty or a third party acting on someone's behalf. For a professional firm, the request touches data protection law, client confidentiality, legal privilege and the practical integrity of the matter file. The statutory clock can begin before anyone has decided who owns the task. That is why a routine matters.
The Clock Starts on Receipt, Not on Recognition
Under the UK GDPR and the Data Protection Act 2018, a controller must respond to a subject access request without undue delay and in any event within one month of receipt. The month runs from the date the request reaches the firm, not the date a partner opens it or the date the IT team forwards it. A request need not use statutory language. If a client asks what personal data the firm holds about them, treat it as a request unless the context clearly indicates otherwise.
The first control is therefore a single intake route. Every member of staff should know where to send a suspected request. The central mailbox should be monitored by a named data protection lead and a deputy. The log should record the date and time of receipt, the requester's identity and capacity, the matters or departments likely to hold data, the one-month deadline and any decision to seek clarification or verify identity.
First Response: Acknowledge, Verify, Do Not Drift
A neutral acknowledgment is usually sensible. It should confirm receipt, explain that the firm will review the request and identify any further information needed, and avoid admissions about the scope or content of the data. Do not ask why the request is being made. Do not invite the requester to withdraw it.
Identity verification should be proportionate. Firms are entitled to be satisfied that the requester is who they say they are, particularly where the request concerns a client file or a matter involving third parties. Requesting excessive identification can itself become a compliance problem. Where an agent acts for the data subject, obtain written authority and verify the agent's identity.
Clarification is different from verification. If a request is genuinely unclear, the firm may ask the requester to explain what they want, but it should not demand that they narrow the request as a condition of answering it. Record any clarification request and the date the clock resumes.
Scope, Search and the Professional File
Professional firms hold data in unusual places: case management systems, email, billing records, attendance notes, draft advices, calendars, mobile messages and archive boxes. A proportionate search should identify the likely custodians and systems, set search terms and date ranges, and record what was searched and what was not. The aim is not a perfect universe of documents but a reasonable and defensible search.
Where the request concerns a client, the file may contain information about other clients, third parties or the firm's internal deliberations. Redaction is often necessary, but it should be done on a documented basis. Personal data relating to third parties should not be disclosed unless consent is held or it is reasonable to disclose without consent. Legal professional privilege may exempt certain communications and documents from disclosure under the DPA 2018. Client confidentiality is not a blanket exemption, but it is a serious consideration when a request comes from someone other than the client.
The Response and the Reason for Every Redaction
The response should normally provide a copy of the personal data, together with information about the purposes of processing, categories of data, recipients, retention and the requester's rights. If an exemption applies, the firm should be able to explain it internally, even if the response itself says only that certain information has been withheld. A redaction log should identify the document, the redaction, the reason and the reviewer.
Complex or numerous requests may justify an extension of up to two further months, but the firm must inform the requester within the first month and explain why. Manifestly unfounded or excessive requests may be refused or charged a reasonable fee, but those conclusions require evidence, not irritation.
The Record That Makes the Routine Defensible
The final control is the record. The log should show receipt, verification, scope, searches, review, redactions, exemptions, response and closure. Trends should be reviewed by management: repeated requests from one source, slow departmental responses or recurring redaction issues may indicate a wider problem. Training should be refreshed so that a request arriving late on a Friday is recognised for what it is.
For Leeds and London firms in 2026, the test is not whether every request feels convenient. It is whether the firm can show a consistent, timely and reasoned response. A calm protocol, applied before the pressure builds, remains the surest form of counsel.
